Security & Vulnerability Disclosure

Last updated: October 4, 2026

Lecture Hat, Inc. welcomes reports of vulnerabilities, privacy issues, and exposed data. This policy explains the systems you may test, how to report findings, and our authorization for good-faith research. The safeguards below describe our configuration; our Privacy Policy and executed agreements govern personal-information obligations.

1. Security measures and limits

• Public connections use HTTPS through Cloudflare, which terminates TLS and can access request contents. Some internal connections use HTTP; this is not a claim of end-to-end encryption.
• Production volumes on Amazon EC2 use Amazon EBS encryption; the data volume on our own server uses AES-256-XTS (LUKS2). The servers communicate through an encrypted WireGuard (Tailscale) tunnel. Encrypted database backups, EBS snapshots, and uploaded-file mirrors are configured for recovery; direct encrypted database, Redis, and uploaded-file backups use Amazon S3 in US East (N. Virginia, us-east-1). Backblaze B2 is the legacy backup provider in US East. Any remaining historical copies are archived and removed after verified restore checks; new direct backups use Amazon S3. Completion and deletion depend on successful jobs; residual backup data may persist pending cleanup.
• Clerk handles authentication. Application data uses PostgreSQL and MinIO. Infrastructure operators can access production data; we do not claim certified personnel access controls or a complete audit log of every access.
• The repository includes automated tests and dependency and container checks. Their presence does not establish that every deployed change has passed every check.
• We investigate incidents and notify affected people and authorities as required by law and applicable executed agreements. No system can guarantee absolute security or recovery of every lost item.

See our Privacy Policy, provider inventory, and Data Flow for processing and backup limitations. We do not publish a SOC 2 report or claim an independent security certification.

2. Systems in scope

This policy applies to websites, application APIs, apps, and extensions owned or operated by Lecture Hat, including lecturehat.com and our askcactus.com transition aliases. Test with accounts you own or have explicit permission to use. Vendor systems, school learning-management systems, and other people's accounts are outside our authorization. Contact us before testing if ownership or scope is unclear.

3. Research rules

• Report findings promptly. Limit testing to what is needed to demonstrate the issue.
• Do not disrupt the service, destroy or alter other people's data, conduct denial-of-service or high-volume scanning, use social engineering, or demand payment as a condition of reporting.
• If you encounter another person's information, stop testing immediately. Do not download more data, disclose it, or retain unnecessary copies. Describe the exposure through the reporting channel below.
• Allow up to 90 days from the initial report for coordinated remediation before public disclosure, or disclose earlier if we confirm remediation. Contact us to discuss a different timeline.
• Follow applicable law. We can authorize only research on systems we control.

4. Report a finding

Email [email protected] with the subject "Security Vulnerability Report." Include the affected URL or version, impact, reproduction steps, and a minimal proof of concept. Redact personal information and credentials. We accept reports without a public identity; tell us how to contact you if you want updates.

5. Our commitments

We will work with you to understand and validate the report, seek to keep you informed, and remediate confirmed issues within our operational constraints. Our targets are acknowledgment within 3 business days, initial triage within 7 business days, and updates every 14 days while active; these are targets rather than guaranteed deadlines. We offer no monetary bounty. Public credit after remediation is subject to your agreement.

6. Safe harbor

For good-faith research that follows this policy, we consider the activity authorized under applicable computer-access and anti-circumvention laws to the extent we can grant authorization. We will not initiate or support legal action for accidental, good-faith violations of this policy or bring a claim for circumvention needed for that authorized research.

We waive restrictions in our Terms of Service, Browser Extension Terms, EULA, and Acceptable Use Policy only to the extent they would prevent research permitted here. For that limited purpose this policy controls a conflict. This does not waive protections for other people's data or authorize testing vendor or school systems. We regard compliant research as helpful and conducted in good faith. If a third party brings a claim, we will take reasonable steps to confirm your compliance; this policy cannot bind that party or authorize testing its systems.

Report contents may be used to investigate, remediate, and document the finding. Please identify sensitive details so we can coordinate disclosure. Mailing contact: Lecture Hat, Inc., Attn: Security, 7710 SW 67th Ave, South Miami, FL 33143-4532, USA.

The reporting, research rules, and safe harbor are adapted from disclose.io's VDP with coordinated disclosure template, released under CC0 1.0. Lecture Hat added its scope, 90-day window, reporting contact, response targets, and configuration disclosures. disclose.io does not endorse this adaptation.